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ABSTRACT 

The concept of function offers a high potential for 
thinking and reasoning about designs as well as providing a 
common thread for relating together other design information. 
This paper focuses specifically on the relation between function 
and risk by examining how this information is addressed for a 
design team conducting early stage design for space missions. 
Risk information is decomposed into a set of key attributes 
which are then used to scrutinize the risk information using 
three approaches from the pragmatics sub-field of linguistics: i) 
Gricean, ii) Relevance Theory, and Functional Analysis. 
Results of this linguistics-based approach descriptively account 
for the context of designer communication with respect to 
function and risk, and offer prescriptive guidelines for 
improving designer communication. 

1.0 INTRODUCTION 

Risk information is an important component throughout 
all stages of the design process that allows engineers to make 
informed decisions. Identifying, communicating with, and 
acting on risk information are difficult tasks given the 
uncertainty' and incompleteness inherent in design. Various 
processes such as Failure Modes and Effects Analysis and 
Process Hazard Analysis are used in industry to elicit risks and 
provide a standard framework on which discussion of risk can 
take place. In general, the goal is to ultimately describe a risk 
in terms of likelihood and consequence regarding a particular 
failure event. Reaching this goal is challenging especially in 
early design stages when physical solutions have not yet been 
selected and the design is described mainly in functional terms. 

Functional descriptions are form independent 
specifications of design solutions that offer convenience for 
early stage design when generally many physical solutions have 
neither been chosen or ruled out. While many function based 
approaches have been proposed including IDEF models (NIST, 
1993) and the functional basis (Hirtz et al., 2002), usage and 


adoption of functional modeling tools in engineering practice is 
mixed with little consensus as to an industry wide functional 
modeling standard for mechanical systems. By comparison, the 
Unified Modeling Language (UML) for software systems is a 
well-refined standard and widely used. Instead, early stage 
design may simply utilize terminology evolved in industry and 
references to physical solutions to support discourse and initial 
system modeling. Understanding the relation between this type 
of terminology and more formal functional languages, such as 
the functional basis, is important because this relation allows 
associations to be drawn between actual design language and 
many types of design information, including risk. This sets the 
stage to explore new design methods that associate risk and 
failure information with functional-like descriptions that occur 
durin ° nsturs! discourse in engineering desisn settings. 

For this paper, we address risk and function information 
with regard to an early stage design team at the Jet Propulsion 
Laboratory known as Team X. We examine how this team 
treats risks through analysis of excerpt samples and related data 
from past Team X design reports. This team performs 
conceptual design for space missions and is a good model for 
studying design activity given the multi disciplinary team 
makeup and the variety of missions involved. 

The purpose of this work is to better understand risk and 
function information as communicated in the Team X setting. 
A brief outline of the paper, as the approach section will detail, 
begins with decomposing risk information into meaningful 
categories. This provides a direct result of risk composition 
and provides a means for analyzing, according to these 
categories, the risk data from a linguistic perspective that 
directly accounts for communication effects. Finally, we 
present a set of functional templates that map between physical 
solution descriptions, as referenced in Team X terminology, to 
functions in the functional basis. These templates provide a 
link between the natural language in a design setting to more 
formal terminology that can then be used in function based 
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methods such as the Function Failure Design Method (Turner et 
al., 2002). 

2.0 BACKGROUND 

The primary articles of interest for this work are risk 
elements , defined broadly here as phrases describing a failure, a 
failure scenario, failure cause, failure effect, an issue to 
consider related to a failure, or a concern related to a failure. 
Risk elements are isolated pieces of data from Team X sessions 
that are the focus of this work. 

Risk elements are elicited, discussed, and documented 
during Team X design sessions. Team X consists of about 19 
members, in a war room type setting to produce conceptual 
designs of space missions (Mark, 2002). One team member is 
tasked with compilation of all risk elements for a given design. 
This involves proactive participation with other team members 
to adequately identify risks. Each risk is recorded in a 2-D 
fever chart with axes of likelihood and consequence of failure. 
Certain failures warrant the generation of mitigations to reduce 
the risk. Risk elements and any mitigations are listed in design 
session results in addition to being used in certain risk support 
tools undergoing continual development such as the Risk 
Analysis Prototype (RAP) tool (Meshkat et al., 2003). 

Part of the interest in investigating risk and function 
information during Team X designs stems from recent work in 
formalizing functions (Hirtz et al., 2002) and failure modes 
(Turner et al., 2003). At present there is also an established 
relationship between product function and failure modes. This 
relationship is dependent on the languages used to describe 
both function and failure (Stone et al., 2005; Turner and Stone, 
2002; Uder et al., 2004). It is desirable to extend this mapping 
to risk assessment and this work uses concepts from linguistics 
to study risk and function information. 

In the area of linguistics, the sub-field of pragmatics deals 
specifically with the issues of how utterances or statements are 
used in communicative acts and how those statements are 
related to the context in which they are spoken (Barsalou, 1992; 
Ward, 19XX; Wilson, 1999). Understanding how people 
produce and comprehend utterances as they relate to a given 
context encapsulates much of the knowledge we seek toward 
explaining how designers communicate with risk and how they 
perhaps should communicate with risk information during 
conceptual design. The following three sections give a 
snapshot of three somewhat competing theories of pragmatics. 

2.1 Gricean Cooperation Principle 

The Gricean approach is perhaps the most often cited 
approach and rests on the Gricean Cooperation Principle. This 
principle consists of 4 maxims that are related to cooperative 
interaction (Barsalou, 1992). The maxims are as follows: 

Quantity: Utterances should be as informative as possible but 

not more informative than required. 

Relevance: Utterances should be relevant to the goals of the 
current conversation. 

Quality: Utterances should be true and based on sound 

evidence. 

Manner: Utterances should be clear, unambiguous, and 

orderly. 


According to this principle, unless the goal of 
communicators is’ deceit, the 4 maxims should be followed for 
the communication to be effective. Therefore, statements of 
risk element should follow all the maxims. 

2.2 Functional Approach 

The functional approach of pragmatics suggests that there 
are seven different functions that can be performed with 
communication. These functions are instrumental, regulatory', 
interaction, personal, imaginative, heuristic, and informative. 
The latter is the most relevant to analyzing risks. 
Communication is said to be informative when the language is 
used to convey information to other people about things not 
visible in the immediate environment. 

For the purposes of this analysis, it is deemed that 
statements of risk should primarily perform the informative 
function of communication. 

2.3 Relevance Theory 

The relevance theory of pragmatics is composed of two 
parts, positive cognitive effect, and processing effort. 

7. Other things being equal, the greater the positive cognitive 
effects achieved by processing an input, the greater the 
relevance of the input to the individual at that time. 

2. Other things being equal, the greater the processing effort 
expanded, the lower the relevance of the input to the individual 
at that time. 

2.4 Background Summary and Motivation 

The above concepts from linguistics provides a theoretical 
basis for analyzing risk data from Team X design sessions and 
prescribing corrective actions to improve communication 
regarding risk and function information. One premise for this 
research is that communication among designers can be 
improved regarding notions of both function and risk by 
addressing the established concepts of pragmatics. In 
particular, we isolate the language of designers, albeit through 
written reports, as the article under examination where we 
apply basic concepts of linguistic analysis to scrutinize current 
design communication practices. The expectation is that our 
conclusions i) will have a positive influence on how Team X 
and similar teams perform their work ii) will help design 
researchers understand certain characteristics of design 
language in general and iii) will expose how a linguistic 
perspective can offer insight into research on designer 
communication. 

3.0 OBJECTIVES 

The overall goal of this work is to analyze risk and 
function content of designer communication in order to 
understand the current deficiencies of risk statements and 
propose a systematic, function based approach to risk 
assessment. Toward this goal, our objectives are to: 

• establish a set of attributes for risk elements, 

• evaluate the risk elements in light of these attributes 
and the three approaches from pragmatics, 
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• propose corrective steps to better address risk. 

4.0 APPROACH 

4.1 Identifying Risk Element Attributes 

Here we develop a set of attributes for risk elements. 
Specific examples of risk elements are given next to understand 
the nature of risk elements. 

4.1 . 1 Risk Element Examples 

The following risk elements illustrate the heterogeneous 
nature of the data within a risk element. The following 
highlights three risk elements to show the nature of risk 
element language and information content. Given the lack of 
specificity for some risk elements, it is difficult in these cases 
to associate a narrow set of functionality with the risk element. 
For example, the risk of an inaccurate landing is associated 
with a great number of functions. 

Example risk element #1: “Instruments not able to view 
sample ” 

In this case it is clear that the performance parameter is “view 
sample accurately,” but there is no hint of exactly what is 
causing the failure. 

Example risk element #2: “Insufficient performance ” 

This risk element is not very informative. 

Example risk element #3: “Insufficient power for drilling 
operations ” 

This risk element is somewhat ambiguous because it is not 
clear if the power source is the problem or if a downstream 
system, for whatever reason, requires more than the specified 
nominal or peak power than this downstream system should. 

Example risk element #4: “Grounding faults during pyros” 

This risk element is clear in description of an event, but does 
not clearly indicate much regarding the context of the event. 

4.1.2 Risk Element Attributes 

Variations in terminology associated with risks are 
apparent when considering different government organizations 
and industry groups including DOD, NASA and ISO based 
standards. The few examples above suggest that significant 
variations exist within documented risks of Team X in terms of 
the information content. In order to analyze these risks, we first 
consider terminology associated with risks from multiple 
standards and practices as listed in Table 1. 

T able 1. Sample Sources for Risk Terminology 

Department of Defense 

NASA - JPL Risk Management 

NASA NPG 7120. 5B (Program and Project 

Management Processes and Requirements) 

Risk Assessment Prototype (RAP risk tool used at JPL) 

Space Systems Risk Assessment (ISO 17666) 

Pet Norske Veritas (DNV) Risk Consultants 

Probablistic Risk Analysis 


A brief review of information from the sources in Table 1 
indicates that there are many types or categories of risk. Some 
examples from ISO 17666 include “risk index, risk trend, 
residual risk, risk scenario,” etc. However, these sources also 
reveal a reasonable consensus on the basic notion of risk in 
which a likelihood and consequence of failure is accounted. As 
noted at the beginning of section 4.1, we take a somewhat 
broad view of risk elements where we account for several 
categories of risk knowing that ultimately much of risk 
information is distilled into basic quantities such as likelihood 
and consequences. 

Given this rather inclusive perspective for risk elements, 
we define five attributes to describe risk element attributes. 
Additional attributes can be defined such as likelihood of 
failure although these five attributes are suitable for studying 
the information found in risk element titles and descriptions, 
which are the primary documented source of how Team X 
designers communicate with risk information. 

For a portion of the risk elements provided (17 earth orbit 
elements and 100 of the moon mission risk elements), each of 
the risk element attributes shown in Table 2 are identified. Due 
to the vagueness of some risk elements, values are not assigned 
to all attributes for the 1 17 risk elements inspected. 

The attributes are defined in Table 2 and an example of 
these attributes is given in Table 3 for the risk element titled 
“Vibration Damage to Telescope” with a description of “Not 
obvious that telescope assemblies will survive launch profile” 
and reference to the “Science” and “Instrument” subsystems. 
The values for each attribute are inferred from the risk element 
title, description and the referenced subsystems. Note that in 
our analysis, we only address functionality for the design 
parameters although one may reasonably also consider other 
system specifications such as geometric or material choices. 
This restriction allows a direct account of function information 
present in risk elements. 


Table 2. Risk Element Attribute Definitions 


Attribute 

Definition 

Performance 
Parameter (P) 

Measurable indicator of system performance with 
respect to design objectives 

Design 

Parameters (D) 

Parameters of a system which can be specified within 
the scope of the design 

Noise 

Parameter (N) 

Parameters of the system or system operation that are 
beyond the control of the designer 

Failure Mode 
(FM) 

A specific event that prevents proper functioning of a 
system 

Failure Scenario 
(FS) 

A sequence of events and their context that results in 
one or more Failure Modes 


Table 3. Example Risk Element Attributes 


Attribute 

Examples ■ 

(P) 

Optical performance parameters for telescope 

(D) 

Primary function - “channel, signal, control magnitude” 
Secondary function - “import, export, sense, process, 
actuate, regulate, change, stop” 

(N) 

Vibration loading due to launch 

(FM) 

Fatigue, structural failure 

(FS) 

Vibration during launch leading to fatigue, structural 
failure of the telescope assembly 
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4.2 Pragmatics Analysis 

The approach is to use a basic set of concepts from 
pragmatics, which is a sub-field of linguistics, to analyze the 
sample of 117 risk elements. We examine Team X 
communication from three perspectives found in pragmatic 
literature as described in the section 2: Gricean, Relevance 
Theory, and a Functional approach. The approach to analyze 
the risk elements consists of four steps. 

Step 1: Relate each linguistic theory to the risk elements. Each 
linguistic theory is written relating to conversation in general, 
this step transforms the generality of the statement to one that 
pertains to risk elements. 

Step 2: Derive specific questions to relate the linguistic 
theories to risk element attributes. These questions transition 
the general statements about risk achieved from Step 1 into 
specific questions about risk element properties. Answering 
these specific risk element property questions aims at validating 
(or invalidating) the general risk statement from Step 1 and thus 
the linguistic theory. 

Step 3: Derive logical relationships for the risk element 
attributes to determine if the linguistic theory criteria is 
satisfied. The relationships between the risk element attributes 
and the linguistic theories determined in Step 2 are translated 
into logical relations in this step. A true result from the logical 
statement implies that the linguistic theory has been satisfied. 

Step 4: Evaluate each risk element. The set of risk elements 
under evaluation are first examined with respect to their risk 
attribute makeup. Then the risk element attribute makeup is 
entered into the logical relationships from Step 43and analyzed. 

The data used to analyze the risk elements is identified for 
the Gricean Cooperation Principle, Functional Approach and 
the Relevance Theory in Tables 4, 5, and 6 respectively. The 
various linguistic theories and theory specific risk element 
relations are described in the following sections. 

4.2.1 Gricean Cooperation Principle 

The Gricean Cooperation Principle is used in this section 
to analyze the risk elements with respect to pragmatics. 
Recalling the four maxims, the first maxim involves quantity. 
It was determined that a risk element that contains information 
about a design parameter and a failure mode had presented the 
minimum quantity of information about the risk element. 
These two attributes were singled out because they identify the 
problem (failure mode) and its effect (design parameter). Also, 


to prevent providing too many risk elements, i.e. too much 
quantity, the two parameters coupled together should only 
appear once per risk analysis. 

The next maxim is relevance. A risk element is deemed 
relevant if it contains any of the 5 risk element attributes this 
work is examining since the goal of the conversation is to 
gather information about potential risks. 

The quality maxim is first concerned with the truth about 
the risk element and then the justification for the risk element. 
Therefore, the first part of the Quality analysis involved 
checking to make sure the risk element is feasible. The second 
part of the quality analysis involves evidence that a particular 
failure mode could occur through past failures or supporting 
calculations. 

The final Gricean maxim is manner. For the purposes of 
this analysis all the risk elements are assumed to be orderly. 
This leaves their clarity and unambiguousness to analyze. A 
risk element is deemed unambiguous if it contains information 
on the source of the problem (failure scenario, noise parameter) 
and the function it affects (design parameter). Furthermore, a 
risk element is deemed clear if it contains information on the 
affected performance (performance parameter), and what is 
causing the problem (failure mode). 

4.2.2 Functional Approach 

Since the risk elements themselves are shared with others 
and the risk element attributes are invisible; yet desirable, 
information, the risk elements are deemed informative if they 
contain information regarding at least one of the risk element 
attributes. 

4.2.3 Relevance Theory 

The proposition dealing with positive cognitive effect was 
related to the risk elements by counting the risk element 
attributes of a risk element. The greater the number of 
attributes in a risk element has the more the positive cognitive 
effect because it has adequately described the risk. The second 
proposition of which relates to processing effort w'as divided 
into two categories, nominal processing and too much 
processing. The risk elements require nominal processing if 
they contain between 3 and 5 of the risk element attributes. If 
there are less than 3 or more information that the risk element 
attributes then the risk element requires too much processing, 
which, in turn, lowers the relevance of the risk item. 
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Table 4: Risk Element Categories of Gricean Cooperation 


Maxim 

Description 

Risk Questions 

Risk 

Property Specific Questions 

Logical 



| 

Attributes 

Concerned 



Relationships 

Quantity 

Utterances should be as 

Is the risk element 

D 

Qn. 1 

Does the risk element contain D 

IF (D & FM) Then 


informative as possible but not 
more informative than 

informative? 

FM 


& FM? 

Qn.l=True 


required. 

Is the risk element 


On. 2 

Does the specific D & FM appear 

If (D & FM are 



efficiently 



only in this particular risk 

specific to the risk) 



informative? 



elements? 

then Qn.2 =True 

Relevance 

Utterances should be relevant 

Is the risk element 

P 

R 

Does the risk element contain 

IF (P or D or N or 


to the goals of the current 

specific to the 

Tty 


P.D.N.FM, or FS? 

FM or FS) then 


conversation. 

particular mission or 

N 



R=True 



spacecraft? 

FM 

FS 




Quality 

Utterances should be true and 

Is the risk element 

P 

Q i i 

Can the FM affect the P? 



based on sound evidence. 

true? 

D 

Q.1.2 

Is the D related to the P? 





N 

Q.1.3 

Can the FM be caused by the FS 





FM 


or N? 





FS 






Is the risk element 

FM 

Q.2.1 

Has the FM occurred previously? 




based on sound 



Are there supporting calculations 




evidence? 


Q.2.2 

for the FM? 


Manner 

Utterances should be clear. 

Is the risk element 

P 

M.1 

Does the risk contain a P and 

IF (P & FM) 


unambiguous and orderly. 

clear? 

FM 


FM? 

Then M. l=True 



Is the risk element 

D 

M.2 

Does the risk contain a D and (N 

IF (D & (N or FS)) 



unambiguous? 

N 

FS 


or FS)? 

Then M.2=True 


Table 5: Risk Element Categories of Function Approach 


Communication 

Function 

Description 

Risk Questions 

Risk 

Attributes 

Concerned 

Property Specific Questions 

Logical 

Relationships 

Informative 

Language is used to convey 
information to other people 
about things not visible in 
the immediate environment. 

Does the risk 

element convey 

information about 
mission risks? 

P 

D 

N 

FM 

FS 

F 

Does the risk element contain a 
location for a problem (P or D) 
and a potential cause of the 
problem ( N or FM or FS)? 

IF {(P or D) & 

(N or FM or FS) 
Then F=True 


Table 6: Risk Element Categories of Relevance Theory 


Relevance- 

Theory 

Principle 

Description 

Risk Questions 

Risk 

Attributes 

Concerned 

Property Specific Questions 

Logical 

Relationships 

Positive Cognitive 

Other things being equal, the 

How well does the 

P 

RT.l 

How many risk element 

Count 

Effect 

greater the positive cognitive 1 

risk element add to 

D 


attributes does the risk element 

(P.D.N.FM.FS) for 


effects achieved by 

the knowledge about 

N 


contain? 

each risk element. 


processing an input, the 

potential concern for 

FM 





greater the relevance of the 

. the mission? 

FS 





input to the individual. 






Processing Effort 

Other things being equal, the 

Does the risk 

P 

RT.2 

Does the risk element contain 

If (Count 


greater the processing effort 

element provide 

D 


too little risk property 

(P,D,N,FM,FS) > 3, 


expanded, the lower the 

only enough 

N 


information or extraneous 

then RT.2 = True 


relevance of the input to the 

information to easily 

FM 


information? 



individual at that time. 

comprehend the 

FS 






mission risk? 






4.3 Functional Template Development 

In addition to analyzing the extent to which functionality 1 
is addressed in risk elements, another issue to consider is the 
broader problem of how functionality is addressed during Team 
X design sessions in general. Based on preliminary inspections 
of the risk element samples as well as on-site observations of 
Team X members during their design sessions, it is clear that 
Team X members utilize a somewhat specialized set of 
terminology to refer to what would otherwise be known as 
functionality. References to physical artifacts are prominent 


when discussing system function. This can be interpreted as a 
very form-centric (noun based) perspective, which poses a 
challenge if the goal is to explicitly account for system 
function. For example, references to an antenna and related 
physical systems may dominate a discussion that from a more 
function-centric view might be focused on functions (verb 
based) such as transmit signal. 

One potential avenue for improving the treatment of 
function and consequently the treatment of function within the 
context of risk in design, is the development of relations 
between the terminology found in the Team X environment 
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with a more formal set of function terms such as those in the 
functional basis (Hirtz et ah, 2002). A key problem is 
addressing functionality involved with space related systems in 
a manner that is both reasonably minimal and comprehensive. 
This gives rise to the notion of a functional template that 
represents a broad set of systems associated with space 
missions. 

Here we develop a set of functional templates that 
intended to represent the breakdown of space mission systems 
in general and show their relation with functions in the 
functional basis language. This breakdown is at a very high 
level as shown in the appendix. This decomposition is intended 
to capture a basic set of physical elements that comprise the 
generality of space missions. Many partitioning schemes are 
possible for making this decomposition and we idenufy four 
systems: ground systems, launch vehicle, spacecraft, and 
payload. Note that these are not intended to replace existing 
work breakdown structures or the basic structure of Team X. 
Instead these four systems are established as a very high level 
set of physical systems. Some of the elements in both work 
breakdown structures and members of Team X have a scope 
that is substantially different than that of a singular physical 
system. The issue of cost is one example. 

The templates are structured as functions versus physical 
systems where the cell elements are assigned with flows. Both 
the functions and the flows are from the functional basis (Hirtz 
et al., 2002) and both are given only for the primary and 
secondary levels. Notation for the flows is given at the 
beginning of the appendix. A brief assessment of these 
templates is discussed in the results section of 5.4. 

5.0 RESULTS 

The sample of risk elements cover 4 mission types: earth 
orbit, solar orbit, moon, and Mars missions. Generally, the 
documented risk elements are highly variable in their level of 
specificity as indicated in the examples in Section 4.1.1. The 
analysis presented here indicated the particular ramifications of 
the variable specificity as it relates to how well the risk element 
is being communicated and therefore (potentially) how well it 
is understood. 

5.1 Gricean Cooperation Principle 

Each risk element was subjected to the logical 
relationships associated with each portion of the maxims listed 
in Table 1. If the logical result was true, then that portion of 
the risk specific maxim was satisfied. A score of all trues 
would imply the risk element to be cooperative, which 
according to Grice is the goal of pragmatic speech. The results 
of this analysis are displayed in Figures 1 and 2. These figures 
shows that the maxim 
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Figure 1: Gricean Risk Element Analysis 
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Figure 2: Gricean Risk Element Analysis - Percentage 

satisfied by the most risk elements is relation. Quantity, 
Quality, and Manner are the least satisfied. A thorough 
examination of the results of each logical test for the least 
satisfied maxims provides insight as to the exact deficiencies. 

The Quantity maxim results are shown in Figure 3. This 
figure depicts that the Earth orbit mission only had 1 risk 
element that satisfied the both of the requirements for quantity; 
therefore, the risk elements that satisfied the first portion of the 
quantity requirements had a design parameter and failure mode 
repeated in the other risk element which satisfied the first 
quantity requirement. Moreover, the moon mission did not 
have any risk elements which satisfied any portion of the 
quantity maxim. This is because there were no failure modes 
recorded in any of the Moon risk elements. 
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Qn.l Qn.2 Quantity = Qn.l & 


Risk Property Specific Question 

Figure 3: Gricean Risk Element Analysis - Quantity 

The Quality Maxim is also deficient, according to Figure 
1 . A breakdown of the requirements for the quality maxim is 
shown in Figure 4. This figure demonstrates that the quality 
maxim had poor results due to requirements Q.1.3, Q.2.1, and 
Q.2.2 for the Moon mission and had poor Earth orbit results on 
all requirements except Q.1.2. As in the Quantity case, this is 
also due to lack of Failure Mode information. 


W Earth orbit 
■ Muon 


Figure 4: Gricean Risk Element Analysis - Quality 

The last of the Gricean maxims is Manner and the 
breakdown of its results are shown in Figure 5. These results 
indicate that M.l fails to satisfy the criteria in all but one case. 
This is again due to the lack of Failure Mode information. 
Also, M.2 is true more of the time; therefore, the risk elements 
tend to be unambiguous but are not totally dear with respect to 
performance parameters and failure modes. It appears that from 
these results the absence of failure mode data is preventing the 
risks from being clear. Interestingly many more are 
unambiguous (specific), despite being unclear. 


Figure 5: Gricean Risk Element Analysis - Manner 

5.2 Functional Approach 

As in the Gricean approach, each risk element was 
subjected to the logical relationships associated with each 
portion of the maxims listed in Table 2. If the logical result 
was true, then the risk element satisfied the requirement for the 
informative function of communication. The results from the 
Functional Approach are displayed in Figures 6 and 7. The 
results indicate that 47% of the Earth orbit and 30% of the 
Moon risk elements satisfy the informative communication 
function. These risk elements present a location for a problem 
(performance or design parameter )and a potential source (noise 
parameter, failure mode, or failure scenario) of the problem. 



Function 

Risk Property Specific Question 


Figure 6: Function Risk Element Analysis 




Risk Property Specific Question 
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Function 

Risk Property Specific Question 


Figure 7: Function Risk Element Analysis-Percentage 
5.3 Relevance Theory 

The relevance theory results differ siightiy from the 
Gricean and Functional Approach results in that there is a count 
of the risk elements which separates the level of positive 
cognitive effect (or degree of satisfaction of RT.l) rather than a 
logical relationship. This portion of the relevance theory is 
concerned with maximizing positive cognitive effect; therefore, 
the results presented here demonstrate the various levels of 
positive cognitive effect (which is greater for a risk element 
which is described by the most risk element attributes) 
demonstrated by the risk elements, see Figures 8 and 9. Of the 
Earth orbit mission risk elements, 35% have at least 4 of the 5 
risk element attributes. However, the Moon mission risk 
elements have at maximum 3 risk element attributes. 



5 4 3 2 1 0 

Number of Risk Properties in Risk 
Elements (RT.l) 


Figure 8: Relevance Theory Risk Element Analysis 
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Figure 9: Relevance Theory Risk Element Analysis- 
Percentage 

Also, with respect to the second portion of the relevance theory, 
processing effort, it was determined that a risk element with at 
least 3 of the risk element properties satisfied the processing 
effort portion of the relevance theory. Figures 8 and 9 show 
that 20% of the moon mission risk elements meet this criteria 
while 35% of the Earth orbit mission risk elements meet this 
requirements. 

5.4 Discussion of Analysis Results 

Of all the attributes for which there is data, the lack of 
failure mode identification is significant. In addition, the 
number of risk elements for which affected functionality was 
identified is low. It is very apparent that the content in the 
sample of risk statements analyzed is deficient in terms of the 
pragmatic principles of communication. 

Overall, it is reasonable to expect that the consistency of 
risk elements can be improved through adoption of a risk 
element format that requires specifications for a reasonable set 
of attributes such as those used in this work. This is in contrast 
to present conditions where the results clearly show the 
potential for greater clarity in documenting risks. Enforcement 
or other regulation of Team adherence to these types of 
attributes seems necessary for improvement. However, the 
authors recognize that modification of current practices may be 
difficult. 

5.5 Functional Template Results and Extensions 

The notion of a template is not new although the data 
presented in the appendix is a new contribution that helps 
illustrate the relation between functions and flows in the 
functional basis with high level systems used in space missions. 
Given the relatively low evidence of function and other 
references from the risk data analyzed in this work, these 
templates are suggestive of potential avenues to improve not 
only the reference of function, but inclusion of all five risk 
element attributes during risk elicitation, exploration, and 
documentation. The following provides a sketch of preliminary 
ideas regarding how this might occur. 
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5.5.1 Basic Concept 

Given the results of this work that indicate a need for 
increasing the reference and consideration of risk element 
properties, a central goal for developing tools such as RAP, is 
to facilitate user awareness of these five risk attributes. 
Without specifying details of a particular implementation or 
user interface, one potential use and extension of the functional 
templates as shown in the Appendix is a concept of a document 
similar to the templates. This concept presented next is better 
described as a worksheet rather than a template. 

Upon developing the templates, it became apparent that 
arranging a matrix with function rows and system columns as 
show in the appendix is a convenient layout for describing the 
functions and flows associated with physical systems. It 
follows from this layout that such an arrangement can be 
redesigned to explicitly include all five risk attributes. Figure 9 
illustrates this concept. 
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Figure 9: Function Based Risk Worksheet 

This concept in Figure 9 is a snapshot of how the five risk 
attributes can be accounted for. As shown, the design 
parameter (D) attribute is represented by the rows of functions. 
With this layout, a system of interest can be documented in 
terms of its functionality, performance parameter (P), noise 
parameter (N), failure mode (FM), failure scenario (FS), and 
risk title or description (R). 

5.5.2 Features and Scenarios of Usage 

Many alternative levels of sophistication are conceivable 
with this worksheet concept. A simple example is direct use of 
a layout like Figure 9 in a spreadsheet where a separate 
document is used for each system of interest. A more elaborate 
and advanced worksheet concept is an interactive spreadsheet, 
web applet or standalone application with underlying 
functionality for advanced features (searching, navigating, and 


reusing data from other sources). Example features might 
include the ability to navigate within hierarchies of physical 
systems, which is the case with the repository based Function- 
Failure Design tool (FFDt) under joint development between 
UMR and NASA-Ames Research Center. Another example of 
other features includes linking between this Risk Worksheet 
and other applications such as Work Breakdown Structures 
(WBS), the RAP tool, and repository tools like the FFDt in 
order to support informed searches based on an appropriate 
blend of archived, perhaps quantitative, risk and function data 
with specific parameters relevant to the mission design at hand. 
For instance, performance parameters relevant to the mission 
are found in abundance in the WBS (eg. mass budget, etc.), 
which is continuously updated during Team X sessions. 
Integrating a risk worksheet concept with other tools such as 
the WBS therefore seems logical in order to reuse data. 

Finally, outlines of two usage scenarios are considered in 
order to illustrate how the function based risk worksheet 
concept offers potential advantages over the current process of 
dealing with risk. An assumption is that users are either the 
Team X member dedicated to risk issues (ie. the “Risk” chair) 
or potentially other Team X members as well depending on the 
degree of overhead necessary to perform the task. 

In the simple scenario of implementing the worksheet in a 
spreadsheet manually for each system, the user can reference 
the functional templates in order to first identify flows 
associated with a given system. These flows can be directly 
used to aid in identifying (P) since these performance 
parameters are often measures of flow variables. A set of (N) 
can be generated because noise parameters are often implied if 
the objective / desired parameter (P) is established. This is 
analogous to playing devils advocate when finding the 
parameters (N) that will disturb system performance (P). Given 
this context of function, flow, performance parameter, noise 
parameter, the user is primed for generating relevant failure 
modes, failure scenarios with the intent of ultimately collapsing 
these factors into a statement of risk in terms of likelihood and 
consequence. 

An advanced scenario of implementing the worksheet 
involves the same overall process as the simple case except that 
enhanced functionality of the worksheet tool facilitates greater 
user flexibility in terms of their task process and greater support 
by reusing data from other sources. Here the user may begin 
with navigating to, or creating a system of interest through a 
browse feature. The user has an option of displaying 
parameters that are currently active from other tools such as the 
WBS. Based on these cues as well as ongoing discourse in the 
design room, the user gradually populates the worksheet, 
perhaps multiple worksheets at various system levels 
concurrently as information becomes more available and more 
concrete. All the while, the worksheet tool prompts the user, 
allows searches, or otherwise provides data from archived 
designs that is relevant to the current design. The final result of 
a set of risks in terms of likelihood and failure is directly 
transferred to the RAP tool. 

5.5.3 Corrective Actions for Addressing Risk 

These features and scenarios are suggestive of a 
significantly improved environment for eliciting, exploring, and 
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documenting risk. Development of these concepts is an 
outcome of our improved understanding of how risk is 
addressed, based on the analysis described in section 4. 
Specifically, our results demonstrate deficiencies in the content 
of risk elements in terms of the principles from pragmatics. 
The use of functional templates, the function based risk 
worksheet concept, and the processes described in the above 
scenarios are our proposed solution for taking corrective 
actions in order to improve how risk is addressed currently in 
Team X sessions. While the advanced tools outlined above 
require development, the simple case as described is deployable 
using the results presented here. Specifically, interested users 
can simply use Figure 9 as a starting point for their 
spreadsheets and implement the process described in the first 
scenario of section 5.5.2. 

6.0 CONCLUSIONS AND FUTURE WORK 

This paper focused on how designers communicate risks, 
and particularly how function is addressed in the risk elements. 
The risk information from a design team conducting an early 
stage design for space missions was decomposed into a set of 
key attributes, which are then used to analyze the risk 
information. Three approaches from the pragmatics sub-field of 
linguistics: i) Gricean, ii) Relevance Theory, and Functional 
Analysis provided insight of how designers communicate risk 
information with respect to certain metrics from these three 
perspectives. The results indicate that it is necessary to have all 
5 attributes to satisfy gricean, which has the most stringent 
criteria. 

This insight into how designers address function in risk 
elements leads to the overall conclusion that users account for 
all five risk element attributes. A practical means for taking 
this approach is by incorporating functional templates. These 
templates relate physical systems generally used in space 
missions with functions from the functional basis. In addition, 
the function based risk worksheet, which is a direct extension 
of the functional temp! cites should sssist designers in effectively 
eliciting, exploring, and documenting with risk with respect to 
the standards of the three linguistic principles. 

The reliance on expert opinion to begin a process of 
establishing risks can hinder risk analysis since the setting of 
design team such as Team X tends to be chaotic. Therefore, a 
tool that presents a preliminary' set of mission risks directly to 
the dedicated risk team member or to other members is useful 
to the design team by reducing the initial dependence of the risk 
chair on the other design team members. Future work should 
investigate the development and efficacy of advanced tool 
features described in section 5.5.2. 
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Appendix: Functional Templates 
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Launch Vehicle Functional Template 



Spacecraft Functional Template 
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